← Vulnerability feed

Vulnerability record · CVE-2014-6078 · published 18 December 2014

CVE-2014-6078: Ibm security access manager for mobile improper access control vulnerability

Ibm · Security Access Manager For Mobile

IBM Security Access Manager for Mobile 8.x before 8.0.1 and Security Access Manager for Web 7.x before 7.0.0 FP10 and 8.x before 8.0.1 do not have a lockout period after invalid login attempts, which makes it easier for remote attackers to obtain admin access via a brute-force attack.

5.0 CVSS 2.0 Medium EPSS 1.4% · top 29.1% CWE-284 · Improper access control
5.0CVSS 2.0 base score
1.4%EPSS exploitation probability, 30 days
NoNot in CISA KEV
2Affected product versions listed by NVD
8References
17 Jun 2026Last modified by NVD

Description

IBM Security Access Manager for Mobile 8.x before 8.0.1 and Security Access Manager for Web 7.x before 7.0.0 FP10 and 8.x before 8.0.1 do not have a lockout period after invalid login attempts, which makes it easier for remote attackers to obtain admin access via a brute-force attack.

AV:N/AC:L/Au:N/C:N/I:P/A:N

Affected products

2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://www-01.ibm.com/support/docview.wss?uid=swg1IV67358
http://www-01.ibm.com/support/docview.wss?uid=swg1IV67581
http://www-01.ibm.com/support/docview.wss?uid=swg21684475 Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/95762
http://www-01.ibm.com/support/docview.wss?uid=swg1IV67358
http://www-01.ibm.com/support/docview.wss?uid=swg1IV67581
http://www-01.ibm.com/support/docview.wss?uid=swg21684475 Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/95762

Track CVE-2014-6078 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.1CVE-2016-3028Ibm security access manager os command injection vulnerabilityIBM Security Access Manager for Web 7.0 before IF2 and 8.0 before 8.0.1.4 IF3 and Security Access Manager 9.0 before 9.0.1.0 IF5 allow remote authent…EPSS 3.5%8.1CVE-2016-3025Ibm security access manager vulnerabilityIBM Security Access Manager for Mobile 8.x before 8.0.1.4 IF3 and Security Access Manager 9.x before 9.0.1.0 IF5 do not properly restrict failed logi…EPSS 1.6%7.8CVE-2013-6329Ibm content manager ondemand for multiplatforms vulnerabilityIBM Global Security Kit (aka GSKit), as used in Content Manager OnDemand 8.5 and 9.0 and other products, allows remote attackers to cause a denial of…EPSS 3.2%7.5CVE-2017-1473Ibm security access manager for web firmware inadequate encryption strength vulnerabilityIBM Security Access Manager Appliance 8.0.0 through 8.0.1.6 and 9.0.0 through 9.0.3.1 uses weaker than expected cryptographic algorithms that could a…EPSS 0.87%7.5CVE-2016-5919Ibm security access manager for web 7.0 firmware inadequate encryption strength vulnerabilityIBM Security Access Manager for Web 7.0.0, 8.0.0, and 9.0.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decryp…EPSS 0.69%7.5CVE-2015-4963Ibm security access manager for web vulnerabilityIBM Security Access Manager for Web 7.x before 7.0.0.16 and 8.x before 8.0.1.3 mishandles WebSEAL HTTPTransformation requests, which allows remote at…EPSS 3.3%6.8CVE-2014-6077Ibm security access manager for web cross-site request forgery vulnerabilityCross-site request forgery (CSRF) vulnerability in IBM Security Access Manager for Mobile 8.x before 8.0.1 and Security Access Manager for Web 7.x be…EPSS 0.63%6.5CVE-2014-6080Ibm security access manager for mobile sql injection vulnerabilitySQL injection vulnerability in IBM Security Access Manager for Mobile 8.x before 8.0.1 and Security Access Manager for Web 7.x before 7.0.0 FP10 and …EPSS 1.0%

Source: NIST National Vulnerability Database (record CVE-2014-6078), CISA KEV, FIRST EPSS (scores of 2026-09-29). This page is refreshed as NVD updates the record.